CVE-2026-49226

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.4

Description Backend post operations allow a low-privileged Author to access posts owned by another Author. The 'admin/controller/content/posts.php' endpoint permits the filter[admin id] parameter to override the server-selected admin restriction and accepts a caller-controlled post id for duplicate and delete actions. Additionally, 'admin/sql/sqlite/post.sql' does not consistently enforce post.admin id. This allows an attacker to view post metadata, discover post identifiers, duplicate posts, or delete posts and related content, which can expose private drafts and lead to content pollution, data loss, or business disruption.

Recommendations Update to version 1.0.8.4.